Writing

Notes & Essays

Featured Walkthroughs

Walkthroughs for vulnerable machines I designed and published for the community across VulNyx, HackMyVM, and DockerLabs.

• groupsVulNyxExploited a Werkzeug regex denial-of-service via catastrophic backtracking to bypass worker processes, followed by group membership abuse for root privilege escalation.
• ledgerHackMyVMWeaponized an unsanitized multipart filename in a Werkzeug CSV upload endpoint for arbitrary code execution, pivoting through SSH to a SUID binary.
• grenadeHackMyVMChained unauthenticated PHP object injection in WordPress GiveWP (CVE-2026-82222) to achieve remote code execution and local credential dumping.
• hannah_coffeeDockerLabsChained an unsanitized studio parameter local file inclusion with vsftpd log poisoning to establish a web shell and leverage Linux file capabilities.

Walkthroughs

I've documented 57 boxes on VulNyx, working through techniques ranging from multi-stage web exploitation to disk-group and capability-based privilege escalation. Read all VulNyx walkthroughs

The HackMyVM collection is the largest at 172 entries, covering everything from WordPress plugin CVEs through kernel-level techniques and custom binary exploitation. Read all HackMyVM walkthroughs

DockerLabs walkthroughs cover 75 Linux containers, tracing attack chains through local file inclusion, JWT token manipulation, and lateral movement between services. Read all DockerLabs walkthroughs